The Delaware Personal Data Privacy Act has one of the lower entry thresholds among state privacy laws: it applies to businesses processing personal data of at least 35,000 Delaware consumers, or 10,000 consumers if more than 20 percent of revenue comes from selling personal data. Unusually, it offers only a narrow exemption for nonprofits, so many nonprofits are covered.
What the Delaware Personal Data Privacy Act Requires
The law follows the Virginia model: a privacy notice, consumer rights to access, correct, delete, and port data, opt-in consent for sensitive data, and opt-outs for targeted advertising, sale, and significant profiling. Recognition of universal opt-out signals became mandatory January 1, 2026, so covered sites need to honor browser-level opt-out preferences.
Enforcement and Penalties
The Delaware Department of Justice enforces the law, with civil penalties of up to $10,000 per violation. A 60-day cure period expired December 31, 2025, so enforcement no longer has to begin with a warning and an opportunity to fix the problem.
Source: Delaware Code Online: HB 154, 6 Del. C. Chapter 12D
Report a violation: If you believe a business is violating this law, you can file a complaint with the Delaware Attorney General Consumer Protection Unit.
